[PATCH 1/2] Fix underallocation of abort_msg_s struct (CVE-2025-0395)

[Adhemerval Zanella Netto]

On 22/01/25 10:09, Siddhesh Poyarekar wrote:
> Include the space needed to store the length of the message itself, in
> addition to the message string.  This resolves BZ #32582.
> 
> Signed-off-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

LGTM, thanks.  I plan to consolidate the assert implementation to avoid
allocate memory, but it can wait for 2.42.

Reviewed: Adhemerval Zanella  <adhemerval.zanella@linaro.org>

> ---
>  assert/assert.c            | 4 +++-
>  sysdeps/posix/libc_fatal.c | 4 +++-
>  2 files changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/assert/assert.c b/assert/assert.c
> index db90b8d7ef..d21d76fa62 100644
> --- a/assert/assert.c
> +++ b/assert/assert.c
> @@ -17,6 +17,7 @@
>  
>  #include <intprops.h>
>  #include <ldsodefs.h>
> +#include <libc-pointer-arith.h>
>  #include <libintl.h>
>  #include <libio/iolibio.h>
>  #include <setvmaname.h>
> @@ -60,7 +61,8 @@ __assert_fail_base (const char *fmt, const char *assertion, const char *file,
>        (void) __fxprintf (NULL, "%s", str);
>        (void) fflush (stderr);
>  
> -      total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
> +      total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
> +			GLRO(dl_pagesize));
>        struct abort_msg_s *buf = __mmap (NULL, total, PROT_READ | PROT_WRITE,
>  					MAP_ANON | MAP_PRIVATE, -1, 0);
>        if (__glibc_likely (buf != MAP_FAILED))
> diff --git a/sysdeps/posix/libc_fatal.c b/sysdeps/posix/libc_fatal.c
> index eb72a380eb..d90cc6c681 100644
> --- a/sysdeps/posix/libc_fatal.c
> +++ b/sysdeps/posix/libc_fatal.c
> @@ -20,6 +20,7 @@
>  #include <errno.h>
>  #include <fcntl.h>
>  #include <ldsodefs.h>
> +#include <libc-pointer-arith.h>
>  #include <paths.h>
>  #include <stdarg.h>
>  #include <stdbool.h>
> @@ -105,7 +106,8 @@ __libc_message_impl (const char *fmt, ...)
>      {
>        WRITEV_FOR_FATAL (fd, iov, iovcnt, total);
>  
> -      total = (total + 1 + GLRO(dl_pagesize) - 1) & ~(GLRO(dl_pagesize) - 1);
> +      total = ALIGN_UP (total + sizeof (struct abort_msg_s) + 1,
> +			GLRO(dl_pagesize));
>        struct abort_msg_s *buf = __mmap (NULL, total,
>  					PROT_READ | PROT_WRITE,
>  					MAP_ANON | MAP_PRIVATE, -1, 0);